HackingTechnologyInformationVulnerability ExploitZero-DayData ExfiltratedCustomer Data InvolvedDelayed DiscoveryIdentity (basic)Government IDMediumContained

COX ENTERPRISES, INC.

bd_8766c6dda720b44a · schema v1 · pii pii-v1

Severity

Medium

Discovered

Sep 29, 2025

Filed

Nov 21, 2025

To disclose

8 weeks

Affected

6state residents only

Linked

10 filings

Confidence

66%

Full breach record for COX ENTERPRISES, INC. →

Cox Enterprises, Inc. notified the New Hampshire Attorney General of a data security incident involving Oracle's E-Business Suite. The breach exploited a zero-day vulnerability between August 9-14, 2025, discovered by Cox on September 29, 2025. Approximately 6 New Hampshire residents were affected, with their names and Social Security numbers potentially exposed. Cox engaged forensic experts, applied security patches, and notified law enforcement. Affected individuals are offered credit monitoring services.

J jump to incidentP pin to compareR raw source

Incident timeline

undetected · 51 days

discovery → filing · 8 weeks / 53 days

Aug 9, 2025

Begins

Sep 29, 2025

Discovered

Nov 21, 2025

Filed

vs. sector median

11 wks faster

This filing is one of 10 about the same incident.View merged incident

Linked disclosures

Why this link?

Ransomware claims (1)

Leak Sitecl0pbd_839c9a8c3542409b2025-10-27 · +25dVerified by operator

Regulatory filings (8) · sorted by filing gap

Texas State AGbd_244cea98a033cd5c2025-11-21Verified
Nebraska State AGbd_40c9054d459138182025-11-20 · +1dVerified by operator
Vermont State AGbd_76c8778cb9fa2c6d2025-11-20 · +1dVerified
Massachusetts State AGbd_969a08a7f00f6f732025-11-20 · +1dVerified by operator

Show 4 more filings ↓up to 4d gap

Indiana State AGbd_a35479fbdcf86c9a2025-11-20 · +1dVerified
Maine State AGbd_c14447cb7482b2fd2025-11-20 · +1dVerified
California State AGbd_d243eedeb344b5f22025-11-20 · +1dVerified
Montana State AGbd_7369119a392f44282025-11-25 · +4dVerified

Name: COX ENTERPRISES, INC.
norm: cox enterprises
Domain: coxenterprises.com

Name: COX ENTERPRISES, INC.
norm: cox enterprises
Domain: coxenterprises.com
Industry: Technologyllm

Discovered: Sep 29, 2025
Breach occurred: Aug 9, 2025 – Aug 14, 2025
Undetected for: 51 daysoccurrence → discovery
Materiality determined: —
Notification sent: Nov 20, 2025
Affected individuals: 6state-resident count only
Data types: Identity (basic)Government ID
Attack vector: Unauthorized Access
MITRE ATT&CK: T1190 Exploit Public-Facing ApplicationT1486 Data Encrypted for Impact
Threat actor: ExternalFinancial
Regulator citations: Notified New Hampshire Attorney General
Initial access: exploit_public_facing

During the incident: Launched an investigation
Applied Oracle's security fix as soon as it became available
Brought in cybersecurity experts and data analysts to review its systems and the data that it thought may have been copied and taken
Been in contact with law enforcement
Changes made: Offering 12 months of free credit monitoring and identity protection services through IDX
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 8 weeks(53 days from discovery to filing)
Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 9 filings · 9 states

View merged incident ↗

Nebraska State AGNov 20 · first

Vermont State AGNov 20 · first

Massachusetts State AGNov 20 · first

Indiana State AGNov 20 · first

Maine State AGNov 20 · first

California State AGNov 20 · first

Texas State AG+1d

New Hampshire State AG+1d · this page

Montana State AG+5d

Pattern: first filing Nov 20 (NE), last Nov 25 (MT) — a 5-day rolling notification. Rolling spreads often mean counsel is filing as thresholds trip per state. Why this link?

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://mm.nh.gov/files/uploads/doj/remote-docs/cox-enterprises-20251121.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Nov 21, 2025
Raw hash: 046186c3d72a092f9bfe9dd5119e291ce97f85162969204ca54bec61e4eb2179

Linked disclosures

Ransomware claims (1)

Regulatory filings (8) · sorted by filing gap

Reporting entityCOX ENTERPRISES, INC.

Victim entityCOX ENTERPRISES, INC.

Incidentdiscovered Sep 29, 2025

Stated responseLaunched an investigation

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenancemm.nh.gov